CVE-2023-28756: Ruby-lang Ruby ReDoS Vulnerability

CVE-2023-28756 Overview

A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Time component through version 0.2.1 in Ruby through version 3.2.1. The Time parser mishandles invalid URLs that contain specific characters, causing an exponential increase in execution time when parsing certain malformed strings to Time objects. This vulnerability allows remote attackers to cause denial of service conditions by supplying crafted input strings that trigger catastrophic backtracking in the regular expression engine.

Critical Impact
Remote attackers can exploit this vulnerability to cause significant CPU resource exhaustion on Ruby applications that parse user-controlled time strings, potentially leading to service degradation or complete denial of service.

Affected Products

Ruby-lang Ruby through version 3.2.1
Ruby-lang Time versions 0.1.0 and 0.2.1
Debian Linux 10.0
Fedora 36, 37, and 38

Discovery Timeline

March 30, 2023 - Ruby-lang releases security advisory for CVE-2023-28756
March 31, 2023 - CVE-2023-28756 published to NVD
November 4, 2025 - Last updated in NVD database

Technical Details for CVE-2023-28756

Vulnerability Analysis

This vulnerability is classified as CWE-1333 (Inefficient Regular Expression Complexity), commonly known as ReDoS. The Ruby Time component uses regular expressions to parse time strings, but certain patterns in the regex allow for catastrophic backtracking when processing specially crafted input. When the Time parser encounters invalid URLs with specific character sequences, the regex engine enters a state where it must explore an exponentially growing number of possible matches before determining that no match exists.

The impact is limited to availability, as the vulnerability does not allow for code execution or data disclosure. However, in web applications or services that parse user-supplied time strings, an attacker can submit malicious input that causes worker processes to become unresponsive, effectively denying service to legitimate users.

Root Cause

The root cause lies in the regular expression patterns used within the Ruby Time component for parsing time strings. The regex contains nested quantifiers or overlapping alternations that create ambiguity in how the input string can be matched. When the parser receives a carefully crafted string that nearly matches the expected pattern but ultimately fails, the regex engine must exhaustively backtrack through all possible matching combinations before concluding that no match exists.

Attack Vector

The attack can be executed remotely over the network without requiring any authentication or privileges. An attacker simply needs to identify an application endpoint that processes time strings using the vulnerable Ruby Time component and submit a malicious string designed to trigger the exponential backtracking behavior.

The vulnerability is particularly dangerous in scenarios where:

Web applications accept date/time input from users
APIs parse time-related headers or parameters
Background workers process time strings from external sources

The attack requires minimal complexity to execute, as the malicious input strings are well-documented and the exploitation pattern is straightforward. No user interaction is required for the attack to succeed.

Detection Methods for CVE-2023-28756

Indicators of Compromise

Abnormally high CPU utilization on application servers processing time-related input
Ruby worker processes becoming unresponsive or timing out during time parsing operations
Increased request latency specifically on endpoints that handle date/time parameters
Application logs showing timeout errors related to Time parsing functions

Detection Strategies

Monitor Ruby application performance metrics for sudden spikes in CPU usage correlated with time parsing operations
Implement request timeout monitoring to detect unusually long-running time parsing operations
Deploy application performance monitoring (APM) to track method-level execution times in the Time component
Use static code analysis to identify locations where user input is passed to Time.parse or related methods

Monitoring Recommendations

Set up alerts for CPU utilization thresholds on Ruby application servers
Configure request timeout logging to capture slow requests involving time parsing
Implement rate limiting on endpoints that accept time-related input to mitigate exploitation attempts
Monitor application health endpoints to quickly detect service degradation

How to Mitigate CVE-2023-28756

Immediate Actions Required

Upgrade the Ruby Time gem to version 0.1.1 or 0.2.2 which contain the fix for this vulnerability
Update Ruby to version 3.2.2 or later which includes the patched Time component
Implement input validation to reject malformed time strings before they reach the Time parser
Add request timeouts around time parsing operations to prevent individual requests from consuming excessive resources

Patch Information

The vulnerability has been fixed in Time gem versions 0.1.1 and 0.2.2. Users should update their Ruby installations or the Time gem directly to receive the security fix. Ruby-lang has published a detailed security advisory with patching instructions. Additional security advisories have been issued by Debian, Fedora, Gentoo, and NetApp.

Workarounds

Implement input length limits on time string parameters to reduce the potential for exploitation
Add input validation using a simple regex pre-check before passing strings to Time.parse
Wrap time parsing operations in timeout blocks to prevent runaway CPU consumption
Consider using alternative time parsing libraries that are not affected by this vulnerability until patching is complete

bash

# Update the Time gem to the patched version
gem update time

# Or specify the patched version in your Gemfile
# gem 'time', '>= 0.2.2'

# Then run bundle update
bundle update time